This is a note to let you know that I've just added the patch titled
ext2: Add sanity checks for group and filesystem size
to the 5.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ext2-add-sanity-checks-for-group-and-filesystem-size.patch
and it can be found in the queue-5.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From d766f2d1e3e3bd44024a7f971ffcf8b8fbb7c5d2 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@xxxxxxx>
Date: Wed, 14 Sep 2022 17:24:42 +0200
Subject: ext2: Add sanity checks for group and filesystem size
From: Jan Kara <jack@xxxxxxx>
commit d766f2d1e3e3bd44024a7f971ffcf8b8fbb7c5d2 upstream.
Add sanity check that filesystem size does not exceed the underlying
device size and that group size is big enough so that metadata can fit
into it. This avoid trying to mount some crafted filesystems with
extremely large group counts.
Reported-by: syzbot+0f2f7e65a3007d39539f@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: kernel test robot <oliver.sang@xxxxxxxxx> # Test fixup
CC: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jan Kara <jack@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext2/super.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1053,6 +1053,13 @@ static int ext2_fill_super(struct super_
sbi->s_blocks_per_group);
goto failed_mount;
}
+ /* At least inode table, bitmaps, and sb have to fit in one group */
+ if (sbi->s_blocks_per_group <= sbi->s_itb_per_group + 3) {
+ ext2_msg(sb, KERN_ERR,
+ "error: #blocks per group smaller than metadata size: %lu <= %lu",
+ sbi->s_blocks_per_group, sbi->s_inodes_per_group + 3);
+ goto failed_mount;
+ }
if (sbi->s_frags_per_group > sb->s_blocksize * 8) {
ext2_msg(sb, KERN_ERR,
"error: #fragments per group too big: %lu",
@@ -1066,9 +1073,14 @@ static int ext2_fill_super(struct super_
sbi->s_inodes_per_group);
goto failed_mount;
}
+ if (sb_bdev_nr_blocks(sb) < le32_to_cpu(es->s_blocks_count)) {
+ ext2_msg(sb, KERN_ERR,
+ "bad geometry: block count %u exceeds size of device (%u blocks)",
+ le32_to_cpu(es->s_blocks_count),
+ (unsigned)sb_bdev_nr_blocks(sb));
+ goto failed_mount;
+ }
- if (EXT2_BLOCKS_PER_GROUP(sb) == 0)
- goto cantfind_ext2;
sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
le32_to_cpu(es->s_first_data_block) - 1)
/ EXT2_BLOCKS_PER_GROUP(sb)) + 1;
Patches currently in stable-queue which might be from jack@xxxxxxx are
queue-5.19/jbd2-fix-potential-buffer-head-reference-count-leak.patch
queue-5.19/jbd2-fix-potential-use-after-free-in-jbd2_fc_wait_bufs.patch
queue-5.19/ext2-add-sanity-checks-for-group-and-filesystem-size.patch
queue-5.19/jbd2-add-miss-release-buffer-head-in-fc_do_one_pass.patch
queue-5.19/fs-record-i_dirty_time-even-if-inode-already-has-i_dirty_inode.patch
queue-5.19/quota-check-next-prev-free-block-number-after-reading-from-quota-file.patch
queue-5.19/ext4-avoid-crash-when-inline-data-creation-follows-dio-write.patch
